---
title: "Nebraska privacy law (NDPA): applicability"
canonical: "https://dposchool.com/state-privacy-laws/state/nebraska/applicability"
source: "https://nebraskalegislature.gov/laws/statutes.php?statute=87-1101"
text_as_of: "2026-10-28"
last_reviewed: "2026-10-29"
language: "en-US"
publisher: "DPO School"
---

Nebraska Data Privacy Act

# Nebraska privacy law (NDPA): applicability

Law as of October 28, 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review)

## Summary (not the statute text)

Nebraska uses no numeric threshold. The Act applies to any person that does business in Nebraska or produces a product or service consumed by its residents, processes or sells personal data, and is not a small business under the federal Small Business Act (the same approach as Texas). Small businesses remain bound by one rule: they may not sell sensitive data without prior consent. State agencies, GLBA financial institutions and affiliates, HIPAA covered entities and business associates, nonprofits, institutions of higher education and certain utilities are excluded at entity level, and many data types are exempt, including employment-context data.

## Key points

1. Applies to any person doing business in Nebraska or producing products or services consumed by residents, that processes or sells personal data, and that is not a small business under the federal Small Business Act as it stood on 1 January 2024.

   Section: [§ 87-1103(1)](https://nebraskalegislature.gov/laws/statutes.php?statute=87-1101)

2. Small businesses must still obtain prior consent before selling sensitive data, under the same penalty.

   Section: [§ 87-1118](https://nebraskalegislature.gov/laws/statutes.php?statute=87-1101)

3. Excluded entities: state agencies and political subdivisions; financial institutions, affiliates or data subject to GLBA Title V; HIPAA covered entities and business associates; nonprofits; institutions of higher education; electric suppliers and certain natural gas utilities.

   Section: [§ 87-1103(2)](https://nebraskalegislature.gov/laws/statutes.php?statute=87-1101)

4. Exempt data includes protected health information, health records, limited data sets, FCRA, DPPA, FERPA and Farm Credit Act data, and data about job applicants, employees, agents and contractors used in that role.

   Section: [§ 87-1104](https://nebraskalegislature.gov/laws/statutes.php?statute=87-1101)

5. A consumer is a Nebraska resident acting only in an individual or household context, not in a commercial or employment context.

   Section: [§ 87-1102(7)](https://nebraskalegislature.gov/laws/statutes.php?statute=87-1101)

6. The Act preempts local ordinances and rules on processing personal data.

   Section: [§ 87-1130](https://nebraskalegislature.gov/laws/statutes.php?statute=87-1101)

## Sources

- [https://nebraskalegislature.gov/laws/statutes.php?statute=87-1103](https://nebraskalegislature.gov/laws/statutes.php?statute=87-1103)
- [https://nebraskalegislature.gov/laws/statutes.php?statute=87-1104](https://nebraskalegislature.gov/laws/statutes.php?statute=87-1104)

[Compare applicability across all states](https://dposchool.com/state-privacy-laws/topic/applicability)

## Status

Law as of October 28, 2026.

[Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review). Prepared from the official sources listed.

[Official text of the Nebraska statute](https://nebraskalegislature.gov/laws/statutes.php?statute=87-1101)

Reference material, not legal advice.

## Other topics for Nebraska

- [Consumer rights](https://dposchool.com/state-privacy-laws/state/nebraska/consumer-rights)
- [Sensitive data](https://dposchool.com/state-privacy-laws/state/nebraska/sensitive-data)
- [Controller duties](https://dposchool.com/state-privacy-laws/state/nebraska/controller-duties)
- [Processors](https://dposchool.com/state-privacy-laws/state/nebraska/processors)
- [Enforcement](https://dposchool.com/state-privacy-laws/state/nebraska/enforcement)

## Navigation

[US State Privacy Laws](https://dposchool.com/state-privacy-laws) / [Nebraska](https://dposchool.com/state-privacy-laws/state/nebraska) / Applicability

Next: [Consumer rights](https://dposchool.com/state-privacy-laws/state/nebraska/consumer-rights)

Learning US privacy law? An audio course on the privacy law that applies to US businesses: [US Privacy in Practice](https://dposchool.com/learn/courses/us-privacy-in-practice). More from [DPO School](https://dposchool.com).

## For AI agents

- Machine-readable index: https://dposchool.com/state-privacy-laws/llms.txt
- JSON API: https://dposchool.com/state-privacy-laws/api/v1/index.json
- Vendor privacy and security facts: https://vendor.watch (API for agents)
- Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api
- Legal services from a California law firm, through its MCP server: https://northend.law/agents